5 Day Course
Introduction
This class will immerse the student into an interactive environment where
they will be shown how to scan, test, hack and secure their own systems. The
lab intensive environment gives each student in-depth knowledge and practical
experience with the current essential security systems. Students will begin by
understanding how perimeter defenses work and then be lead into scanning and
attacking their own networks, no real network is harmed. Students then learn
how intruders escalate privileges and what steps can be taken to secure a
system. Students will also learn about Intrusion Detection, Policy Creation,
Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation. When a
student leaves this intensive 5 day class they will have hands on understanding
and experience in Ethical Hacking. This course prepares you for EC-Council
Certified Ethical Hacker exam 312-50
Prerequisites
Ethical Hacking and
Countermeasures course mission is to educate, introduce and demonstrate hacking
tools for penetration testing purposes only. Prior to attending this course,
you will be asked to sign an agreement stating that you will not use the newly
acquired skills for illegal or malicious attacks and you will not use such
tools in an attempt to compromise any computer system, and to indemnify
EC-Council with respect to the use or misuse of these tools, regardless of
intent.
Course Outline
Lesson 1: Introduction to Ethical Hacking
•
Problem
Definition -Why Security?
•
Essential
Terminologies
•
Elements
of Security
•
The
Security, Functionality and Ease of Use Triangle
•
Case
Study
•
What does
a Malicious Hacker do?
•
Types of
Hacker Attacks
•
Hacktivism
•
Hacker
Classes
•
Security
News: Suicide Hacker
•
Ethical
Hacker Classes
•
What do
Ethical Hackers do?
•
Can
Hacking be Ethical
•
How to
become an Ethical Hacker
•
Skill
Profile of an Ethical Hacker
•
What is
Vulnerability Research?
•
How to
Conduct Ethical Hacking
•
How Do
They Go About It?
•
Approaches
to Ethical Hacking
•
Ethical
Hacking Testing
•
Ethical
Hacking Deliverables
•
Computer
Crimes and Implications
Lesson 2: Hacking Laws
•
http://www.usdoj.gov
•
http://www.gob.mx/
•
http://www.jf.gov.br/
•
http://canada.justice.gc.ca/en/
•
http://www.opsi.gov.uk
•
http://europa.eu/
•
Belgium
Laws
•
Denmark
Laws
•
France
Laws
•
German
Laws
•
Greece
Laws
•
Italian
Laws
•
Netherlands
Laws
•
Norway
•
The
Cybercrime Act 2001
•
The
Information Technology Act
•
Japans
Cyber Laws
•
Singapores
Cyber Laws
•
Act on
Promotion of Information and Communications Network Utilization and Information
Protection
•
The
Computer Crimes Act 1997
•
http://www.legislation.gov.hk/
•
Telecommunication
Law
Lesson 3: Footprinting
•
Revisiting
Reconnaissance
•
Defining
Footprinting
•
Why is
Footprinting Necessary
•
Areas
and Information which Attackers Seek
•
Information
Gathering Methodology
•
Footprinting
Tools
•
E-Mail
Spiders
•
Steps to
Create Fake Login Pages
•
How to Create
Fake Login Pages
•
Websites
using Man-in-the-Middle Phishing Kit
•
Benefits
to Fraudster
•
Steps to
Perform Footprinting
Lesson 4: Google Hacking
•
What is
Google hacking
•
What a
hacker can do with vulnerable site
•
Anonymity
with Caches
•
Using
Google as a Proxy Server
•
Directory
Listings
•
Going
Out on a Limb: Traversal Techniques
•
Extension
Walking
•
Site
Operator
•
intitle:index.of
•
error |
warning
•
login |
logon
•
username
| userid | employee.ID | your username is
•
password
| passcode | your password is
•
admin |
administrator
•
ext:html
ext:htm ext:shtml ext:asp ext:php
•
inurl:temp
| inurl:tmp | inurl:backup | inurl:bak
•
intranet
| help.desk
•
Locating
Public Exploit Sites
•
Locating
Vulnerable Targets
•
Web
Server Software Error Messages
•
Application
Software Error Messages
•
Default
Pages
•
Searching
for Passwords
•
Google
Hacking Database (GHDB)
•
SiteDigger
Tool
•
Gooscan
•
Goolink
Scanner
•
Goolag
Scanner
•
Tool:
Google Hacks
•
Google
Hack Honeypot
•
Google
Protocol
•
Google
Cartography
Lesson 5: Scanning
•
Scanning:
Definition
•
Types of
Scanning
•
Objectives
of Scanning
•
CEH
Scanning Methodology
•
War
Dialer Technique
•
Banner
Grabbing
•
Vulnerability
Scanning
•
Draw
Network Diagrams of Vulnerable Hosts
•
Preparing
Proxies
•
Scanning
Countermeasures
•
Tool:
SentryPC
Lesson 6: Enumeration
•
Overview
of System Hacking Cycle
•
What is
Enumeration?
•
Techniques
for Enumeration
•
NetBIOS
Null Sessions
•
PS Tools
•
Network
Management Protocol (SNMP) Enumeration
•
LDAP
enumeration
•
NTP
enumeration
•
SMTP
enumeration
•
Web
enumeration
•
Winfingerprint
•
How To
Enumerate Web Application Directories in IIS Using DirectoryServices
•
IP Tools
Scanner
•
Enumerate
Systems Using Default Password
•
Tools:
Steps to Perform Enumeration
Lesson 7: System Hacking
•
Part 1-
Cracking Password
•
Part 2-
Escalating Privileges
•
Part 3 -
Executing applications
•
Part 4 -
Hiding files
•
Part 5 -
Covering Tracks
Lesson 8: Trojans and Backdoors
•
Effect
on Business
•
What is
a Trojan?
•
Indications
of a Trojan Attack
•
Ports
Used by Trojans
•
Trojans
•
Classic
Trojans Found in the Wild
•
Hacking
Tool: Loki
•
Atelier Web
Remote Commander
•
Trojan
Horse Construction Kit
•
How to
Detect Trojans?
•
Anti-Trojan
Software
•
Evading
Anti-Virus Techniques
•
Sample
Code for Trojan Client/Server
•
Evading
Anti-Trojan/Anti-Virus using Stealth Tools
•
Backdoor
Countermeasures
•
Tripwire
•
System
File Verification
•
MD5
Checksum.exe
•
Microsoft
Windows Defender
•
How to
Avoid a Trojan Infection
Lesson 9: Viruses and Worms
•
Virus
History
•
Characteristics
of Virus
•
Working
of Virus
•
Why
people create Computer Viruses
•
Symptoms
of a Virus-like Attack
•
Virus
Hoaxes
•
Chain
Letters
•
How is a
Worm Different from a Virus
•
Indications
of a Virus Attack
•
Hardware
Threats
•
Software
Threats
•
Virus
Damage
•
Stages
of Virus Life
•
Virus
Classification
•
How Does
a Virus Infect?
•
Storage
Patterns of Virus
•
Famous
Virus/Worms I Love You Virus
•
Famous
Virus/Worms Melissa
•
Famous
Virus/Worms JS/Spth
•
Klez
Virus Analysis
•
Latest
Viruses
•
Top 10
Viruses- 2008
•
Writing
a Simple Virus Program
•
Virus
Construction Kits
•
Virus
Detection Methods
•
Virus
Incident Response
•
What is
Sheep Dip?
•
Virus
Analysis IDA Pro Tool
•
Prevention
is better than Cure
•
Anti-Virus
Software
•
Popular
Anti-Virus Packages
•
Virus
Databases
Lesson 10: Sniffers
•
Definition
- Sniffing
•
Protocols
Vulnerable to Sniffing
•
Tool:
Network View Scans the Network for Devices
•
The Dude
Sniffer
•
Wireshark
•
Display
Filters in Wireshark
•
Following
the TCP Stream in Wireshark
•
Cain and
Abel
•
Tcpdump
•
Tcpdump
Commands
•
Types of
Sniffing
•
What is
ARP?
•
IP-based
sniffing
•
Linux
Sniffing Tools (dsniff package)
•
DNS
Poisoning Techniques
•
Interactive
TCP Relay
•
Interactive
Replay Attacks
•
Raw
Sniffing Tools
•
Features
of Raw Sniffing Tools
•
How to
Detect Sniffing
•
Countermeasures
Lesson 11: Social Engineering (DVD)
Lesson 12: Phishing (DVD)
Lesson 13: Hacking Email Accounts (DVD)
Lesson 14: Denial-of-Service
•
Real World
Scenario of DoS Attacks
•
What are
Denial-of-Service Attacks?
•
Goal of
DoS
•
Impact
and the Modes of Attack
•
Types of
Attacks
•
DoS
Attack Classification
•
Bot
(Derived from the Word RoBOT)
•
What is
a DDoS Attack?
•
DDoS
Tools
•
Worms
•
How to
Conduct a DDoS Attack
•
The
Reflected DoS Attacks
•
Reflection
of the Exploit
•
Countermeasures
for Reflected DoS
•
DDoS
Countermeasures
•
Taxonomy
of DDoS Countermeasures
•
Preventing
Secondary Victims
•
Detect
and Neutralize Handlers
•
Detect
Potential Attacks
•
DoSHTTP
Tool
•
Mitigate
or Stop the Effects of DDoS Attacks
•
Deflect
Attacks
•
Post-attack
Forensics
•
Packet
Traceback
Lesson 15: Session Hijacking
•
What is
Session Hijacking?
•
Spoofing
vs. Hijacking
•
Steps in
Session Hijacking
•
Types of
Session Hijacking
•
Session
Hijacking Levels
•
Network Level
Hijacking
•
The
3-Way Handshake
•
TCP
Concepts 3-Way Handshake
•
Sequence
Numbers
•
TCP/IP
hijacking
•
IP
Spoofing: Source Routed Packets
•
RST
Hijacking
•
Blind
Hijacking
•
Man in
the Middle: Packet Sniffer
•
UDP
Hijacking
•
Application
Level Hijacking
•
Programs
that Performs Session Hacking
•
Dangers
that hijacking Pose
•
Protecting
against Session Hijacking
•
Countermeasures:
IPsec
Lesson 16: Hacking Web Servers
•
How Web
Servers Work
•
How are
Web Servers Compromised
•
Web
Server Defacement
•
Attacks
against IIS
•
Unicode
•
Hotfixes
and Patches
•
Solution:
UpdateExpert
•
Vulnerability
Scanners
•
Online
Vulnerability Search Engine
•
Network
Tool: Whisker
•
Network
Tool: N-Stealth HTTP Vulnerability Scanner
•
Hacking
Tool: WebInspect
•
Network
Tool: Shadow Security Scanner
•
Secure
IIS
•
Countermeasures
•
Increasing
Web Server Security
•
Web
Server Protection Checklist
Lesson 17: Web Application Vulnerabilities
•
Web
Application Setup
•
Web
application Hacking
•
Anatomy
of an Attack
•
Web
Application Threats
•
Cross-Site
Scripting/XSS Flaws
•
SQL
Injection
•
Command Injection
Flaws
•
Cookie/Session
Poisoning
•
Parameter/Form
Tampering
•
Hidden
Field at
•
Buffer
Overflow
•
Directory
Traversal/Forceful Browsing
•
Cryptographic
Interception
•
Cookie
Snooping
•
Authentication
Hijacking
•
Log
Tampering
•
Error
Message Interception
•
Attack
Obfuscation
•
Platform
Exploits
•
DMZ
Protocol Attacks
•
Security
Management Exploits
•
TCP
Fragmentation
•
Hacking
Tools
Lesson 18: Web-Based Password Cracking Techniques
•
Authentication
- Definition
•
Authentication
Mechanisms
•
Bill
Gates at the RSA Conference 2006
•
How to
Select a Good Password
•
Things
to Avoid in Passwords
•
Changing
Your Password
•
Protecting
Your Password
•
Examples
of Bad Passwords
•
The
Mary Had A Little Lamb Formula
•
How
Hackers Get Hold of Passwords
•
Windows
XP: Remove Saved Passwords
•
What is a
Password Cracker?
•
Modus
Operandi of an Attacker Using a Password Cracker
•
How Does
a Password Cracker Work?
•
Attacks
- Classification
•
Password
Crackers Available
•
Countermeasures
Lesson 19: SQL Injection
•
What is
SQL Injection?
•
Exploiting
Web Applications
•
Steps
for performing SQL injection
•
What You
Should Look For
•
What If
It Doesnt Take Input
•
OLE DB
Errors
•
Input
Validation Attack
•
SQL
injection Techniques
•
How to
Test for SQL Injection Vulnerability
•
How Does
It Work?
•
BadLogin.aspx.cs
•
BadProductList.aspx.cs
•
Executing
Operating System Commands
•
Getting
Output of SQL Query
•
Getting
Data from the Database Using ODBC Error Message
•
How to
Mine all Column Names of a Table
•
How to
Retrieve any Data
•
How to
Update/Insert Data into Database
•
SQL
Injection in Oracle
•
SQL Injection
in MySql Database
•
Attacking
Against SQL Servers
•
SQL
Server Resolution Service (SSRS)
•
Osql -L
Probing
•
SQL
Injection Automated Tools
•
Blind
SQL Injection
•
SQL
Injection Countermeasures
•
Preventing
SQL Injection Attacks
•
GoodLogin.aspx.cs
•
SQL
Injection Blocking Tool: SQL Block
•
Acunetix
Web Vulnerability Scanner
Lesson 20: Hacking Wireless Networks
•
Introduction
to Wireless
•
Wireless
Standards
•
Wireless
Concepts and Devices
•
WEP and
WPA
•
Attacks
and Hacking Tools
•
Scanning
Tools
•
Sniffing
Tools
•
Hacking
Wireless Networks
•
Wireless
Security
•
Wireless
Security Tools
Lesson 21: Physical Security (DVD)
Lesson 22: Linux Hacking
•
Why
Linux?
•
Linux
Distributions
•
Linux
Live CD-ROMs
•
Basic
Commands of Linux: Files & Directories
•
Directories
in Linux
•
Installing,
Configuring, and Compiling Linux Kernel
•
How to
Install a Kernel Patch
•
Compiling
Programs in Linux
•
GCC
Commands
•
Make
Files
•
Make
Install Command
•
Linux
Vulnerabilities
•
Chrooting
•
Why is
Linux Hacked?
•
How to
Apply Patches to Vulnerable Programs
•
Scanning
Networks
•
Nmap in
Linux
•
Scanning
Tool: Nessus
•
Port
Scan Detection Tools
•
Password
Cracking in Linux: Xcrack
•
Firewall
in Linux: IPTables
•
IPTables
Command
•
Basic
Linux Operating System Defense
•
SARA
(Security Auditor's Research Assistant)
•
Linux
Tool: Netcat
•
Linux Tool:
tcpdump
•
Linux
Tool: Snort
•
Linux
Tool: SAINT
•
Linux
Tool: Wireshark
•
Linux
Tool: Abacus Port Sentry
•
Linux
Tool: DSniff Collection
•
Linux
Tool: Hping2
•
Linux
Tool: Sniffit
•
Linux
Tool: Nemesis
•
Linux
Tool: LSOF
•
Linux
Tool: IPTraf
•
Linux
Tool: LIDS
•
Hacking
Tool: Hunt
•
Tool:
TCP Wrappers
•
Linux
Loadable Kernel Modules
•
Hacking
Tool: Linux Rootkits
•
Rootkits:
Knark & Torn
•
Rootkits:
Tuxit, Adore, Ramen
•
Rootkit:
Beastkit
•
Rootkit
Countermeasures
Topic 22AT: 'chkrootkit
detects the following Rootkits
•
Linux
Tools: Application Security
•
Advanced
Intrusion Detection Environment (AIDE)
•
Linux
Tools: Security Testing Tools
•
Linux
Tools: Encryption
•
Linux
Tools: Log and Traffic Monitors
•
Linux
Security Auditing Tool (LSAT)
•
Linux
Security Countermeasures
•
Steps
for Hardening Linux
Lesson 23: Evading IDS, Firewalls and Detecting Honey Pots
•
Introduction
to Intrusion Detection System
•
Terminologies
•
Intrusion
Detection System (IDS)
•
What is
a Firewall?
•
Common
Tool for Testing Firewall and IDS
•
What is
a Honeypot?
•
Tools to
Detect Honeypots
•
What to
do when hacked
Lesson 24: Buffer Overflows
•
Why are
Programs/Applications Vulnerable?
•
Buffer
Overflows
•
Reasons
for Buffer Overflow Attacks
•
Knowledge
Required to Program Buffer Overflow Exploits
•
Understanding
Stacks
•
Understanding
Heaps
•
Types of
Buffer Overflows: Stack-based Buffer Overflow
•
Types of
Buffer Overflows: Heap-based Buffer Overflow
•
Understanding
Assembly Language
•
How to
Detect Buffer Overflows in a Program
•
NOPs
•
How to
Mutate a Buffer Overflow Exploit
•
Once the
Stack is Smashed
•
Defense Against
Buffer Overflows
•
Buffer
Overflow Protection Solution: Libsafe
•
Simple
Buffer Overflow in C
Lesson 25: Cryptography
•
Introduction
to Cryptography
•
Classical
Cryptographic Techniques
•
Cryptographic
Algorithms
•
RSA
(Rivest Shamir Adleman)
•
Data
Encryption Standard (DES)
•
RC4,
RC5, RC6, Blowfish
•
Message
Digest Functions
•
SHA
(Secure Hash Algorithm)
•
SSL
(Secure Sockets Layer)
•
What is
SSH?
•
Algorithms
and Security
•
Disk
Encryption
•
Government
Access to Keys (GAK)
•
Digital
Signature
•
Digital
Certificates
•
PGP (Pretty
Good Privacy)
•
CypherCalc
•
Command
Line Scriptor
•
CryptoHeaven
•
Hacking
Tool: PGP Crack
•
Magic
Lantern
•
Advanced
File Encryptor
•
Encryption
Engine
•
Encrypt
Files
•
Encrypt
PDF
•
Encrypt
Easy
•
Encrypt
my Folder
•
Advanced
HTML Encrypt and Password Protect
•
Encrypt HTML
source
•
Alive
File Encryption
•
Omziff
•
ABC
CHAOS
•
EncryptOnClick
•
CryptoForge
•
SafeCryptor
•
CrypTool
•
Microsoft
Cryptography Tools
•
Polar
Crypto Light
•
CryptoSafe
•
Crypt
Edit
•
CrypSecure
•
Cryptlib
•
Crypto++
Library
•
Code
Breaking: Methodologies
•
Cryptanalysis
•
Cryptography
Attacks
•
ToBrute-Force
Attack
•
Cracking
S/MIME Encryption Using Idle CPU Time
•
distributed.net
•
Use Of
Cryptography
